docs(release): record brace-expansion fix + the two audit scopes

Add the dev-dep brace-expansion high (commit b26b7f9) to the applied-fix list and
the key lesson: CI has two audit scopes — Release Health/Security Audit run --prod,
Test & Quality runs --audit-level=high without --prod. brace-expansion hid between
them. Verification now records both scopes exit 0.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011ZL1AroezCKPRB7aNGoygc

Author: Arthur Silva

docs/2026-07-25-v0.1.0-release-readiness.md

@@ -122,6 +122,11 @@ apps + build tooling.
   blanket, so it beat any conditional; had to edit the pin itself).
 - Added conditional bumps (only the vulnerable ranges): `fast-uri@>=3.0.0 <=3.1.3 → ^3.1.4`,
   `postcss@<=8.5.17 → ^8.5.18`, `sharp@<0.35.0 → ^0.35.0`, `svgo@>=4.0.0 <4.0.2 → ^4.0.2`.
+- **`brace-expansion`** across four major lines (`<1.1.16 → ^1.1.16`, `>=2.0.0 <2.1.2 → ^2.1.2`,
+  `>=3.0.0 <5.0.7 → ^5.0.7`, `<=5.0.7 → ^5.0.8`) — a **dev-dep** DoS high (commit `b26b7f91`). Two
+  audit SCOPES exist in CI and this hid between them: Release Health + Security Audit run `pnpm audit
+  --prod` (prod deps, never saw it); **Test & Quality runs `pnpm audit --audit-level=high` WITHOUT
+  `--prod`** (dev deps too) and failed on it. Fixing one gate is not fixing "the audit" — check both.
 - **`astro` deliberately NOT bumped.** Its advisory says "patched `>=7.0.10`", but `7.0.10` does
   not exist — the line goes `7.0.9 → 7.1.0` (latest `7.1.3`), so the fix is a `7.0 → 7.1` MINOR bump.
   **Verified that bump breaks the apps:** on astro `7.1.3` the Rolldown-Vite bundler rejects a
@@ -131,8 +136,9 @@ apps + build tooling.
   them = migrating the apps to astro 7.1 (its own task — a real code-compat change, not an override).
 - `dompurify` was left at `3.4.11`; the current audit does not flag it.
 
-**Verification (this machine, public registry):** `pnpm audit --prod --audit-level high` exits 0
-(0 high); all apps build (`turbo run build --filter='./apps/*'` → 78/78); astro unchanged at 7.0.3.
+**Verification (this machine, public registry):** BOTH audit scopes exit 0 — `pnpm audit --prod
+--audit-level high` AND `pnpm audit --audit-level high` (non-prod, dev deps); all apps build
+(`turbo run build --filter='./apps/*'` → 78/78); reqbench-t3 tests pass; astro unchanged at 7.0.3.
 The environment gotchas above (Nexus 400, `security:fix` masking) are resolved *for this repo* by the
 committed `.npmrc` `registry=https://registry.npmjs.org/` override (commit `0a0a5aa7`) — a developer's
 global corporate config is untouched. (`scripts/security/audit-fix.mjs` should still be hardened to